okengine 0.22.0 → 0.23.0

package/src/cli/dev-app-runner.ts

@@ -21,6 +21,8 @@
 
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { closeSharedPostgresClients } from "../drivers/postgres.ts";
+import { installDevHotGeneration, takeDevHotGeneration } from "./dev-hot.ts";
 import { installGracefulShutdown, type GracefulShutdownApp } from "../kernel/graceful-shutdown.ts";
 import type { Manifest } from "../manifest/types.ts";
 import { createBunRuntime } from "../runtime/bun.ts";
@@ -67,22 +69,36 @@ if (manifestPath !== undefined && manifestPath.length > 0) {
   }
 }
 
+// Soft reload re-enters this file in the same process. Stop the previous
+// boot's 1s scheduler and close its Bun.SQL pools before opening new ones.
+// Holder `close()` is a no-op on the shared pool, so this has to be explicit.
+const previous = takeDevHotGeneration();
+if (previous) {
+  try {
+    await previous.dispose();
+  } catch (err) {
+    console.error(
+      `oke dev: previous hot generation failed to dispose — ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    );
+  }
+}
+await closeSharedPostgresClients();
+
 const absoluteEntry = resolve(entry);
 const mod = (await import(pathToFileURL(absoluteEntry).href)) as {
   app?: BootableApp;
 };
+const app = mod.app;
 
-if (
-  mod.app === undefined ||
-  typeof mod.app.boot !== "function" ||
-  typeof mod.app.fetch !== "function"
-) {
+if (app === undefined || typeof app.boot !== "function" || typeof app.fetch !== "function") {
   console.error(`oke dev: ${absoluteEntry} must export app with boot() and fetch()`);
   process.exit(1);
 }
 
 try {
-  await mod.app.boot({
+  await app.boot({
     rootDir: process.env["OKE_ROOT_DIR"],
     ...(manifest !== undefined ? { manifest } : {}),
   });
@@ -94,12 +110,22 @@ try {
   console.error(formatFatalError(err));
   process.exit(1);
 }
-const handle = createBunRuntime().serve(mod.app, {
+const handle = createBunRuntime().serve(app, {
   port,
   hostname,
   id: DEV_APP_SERVE_ID,
 });
-installGracefulShutdown({ app: mod.app, handle });
+const { watchDecisionLockfile } = await import("./decision-lock-watch.ts");
+const decisionLockWatch = watchDecisionLockfile(process.env.OKE_ROOT_DIR ?? process.cwd());
+const removeSignals = installGracefulShutdown({ app, handle });
+installDevHotGeneration({
+  async dispose() {
+    decisionLockWatch.close();
+    removeSignals();
+    await app.stop();
+    await closeSharedPostgresClients();
+  },
+});
 
 const appUrl = `http://${formatHostForUrl(hostname)}:${handle.port}`;
 // Parent board (claim + Docker) stays. Bun `--no-clear-screen` + no child wipe.

package/src/cli/dev-auth-secret.test.ts

@@ -0,0 +1,49 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { ensureDevAuthSecret } from "./dev-auth-secret.ts";
+
+describe("ensureDevAuthSecret", () => {
+  const dirs: string[] = [];
+  const prev = process.env.OKE_AUTH_SECRET;
+
+  afterEach(async () => {
+    if (prev === undefined) delete process.env.OKE_AUTH_SECRET;
+    else process.env.OKE_AUTH_SECRET = prev;
+    await Promise.all(dirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+  });
+
+  test("reuses process.env and does not write a file", async () => {
+    process.env.OKE_AUTH_SECRET = "from-env";
+    const dir = await mkdtemp(join(tmpdir(), "oke-auth-secret-"));
+    dirs.push(dir);
+    expect(await ensureDevAuthSecret(dir)).toBe("from-env");
+    expect(await Bun.file(join(dir, ".env.local")).exists()).toBe(false);
+  });
+
+  test("reads .env.local before minting", async () => {
+    delete process.env.OKE_AUTH_SECRET;
+    const dir = await mkdtemp(join(tmpdir(), "oke-auth-secret-"));
+    dirs.push(dir);
+    await Bun.write(
+      join(dir, ".env.local"),
+      "DATABASE_URL=postgres://localhost/oke\nOKE_AUTH_SECRET=from-file\n",
+    );
+    expect(await ensureDevAuthSecret(dir)).toBe("from-file");
+  });
+
+  test("mints once and appends to .env.local", async () => {
+    delete process.env.OKE_AUTH_SECRET;
+    const dir = await mkdtemp(join(tmpdir(), "oke-auth-secret-"));
+    dirs.push(dir);
+    await Bun.write(join(dir, ".env.local"), "DATABASE_URL=postgres://localhost/oke\n");
+    const first = await ensureDevAuthSecret(dir);
+    expect(first.startsWith("oke_dev_")).toBe(true);
+    const text = await readFile(join(dir, ".env.local"), "utf8");
+    expect(text).toContain(`OKE_AUTH_SECRET=${first}`);
+    expect(text.startsWith("DATABASE_URL=")).toBe(true);
+    delete process.env.OKE_AUTH_SECRET;
+    expect(await ensureDevAuthSecret(dir)).toBe(first);
+  });
+});

package/src/cli/dev-auth-secret.ts

@@ -0,0 +1,49 @@
+/**
+ * One HMAC secret for `oke dev`.
+ *
+ * Console boots the app in the parent; the HTTP server is a child. Each
+ * process would otherwise mint its own `gate.auth` secret, and a Bearer API
+ * key hashed in Console would not verify on the app. This stores one
+ * `OKE_AUTH_SECRET` in `.env.local` and returns it for both.
+ */
+
+import { join } from "node:path";
+import { mintDevAuthSecret } from "../auth/config.ts";
+import { escapeDotenvValue, parseDotenv } from "../drivers/vault-dotenv-parse.ts";
+
+/**
+ * Resolve the shared dev auth secret.
+ *
+ * Order: `process.env.OKE_AUTH_SECRET`, then `.env.local`, then a minted
+ * value appended to `.env.local`. Does not write `process.env`.
+ *
+ * @param cwd - Project root
+ */
+export async function ensureDevAuthSecret(cwd: string): Promise<string> {
+  const current = process.env.OKE_AUTH_SECRET?.trim();
+  if (current) return current;
+
+  const envPath = join(cwd, ".env.local");
+  let text = "";
+  const file = Bun.file(envPath);
+  if (await file.exists()) {
+    try {
+      text = await file.text();
+    } catch {
+      text = "";
+    }
+  }
+  const fromFile = parseDotenv(text).get("OKE_AUTH_SECRET")?.trim();
+  if (fromFile) return fromFile;
+
+  const secret = mintDevAuthSecret();
+  const line = `OKE_AUTH_SECRET=${escapeDotenvValue(secret)}`;
+  const next =
+    text.length === 0
+      ? `${line}\n`
+      : text.endsWith("\n")
+        ? `${text}${line}\n`
+        : `${text}\n${line}\n`;
+  await Bun.write(envPath, next);
+  return secret;
+}

package/src/cli/dev-hot.test.ts

@@ -0,0 +1,41 @@
+/**
+ * Soft-reload slot: one live generation, disposed before the next boot.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { installDevHotGeneration, takeDevHotGeneration } from "./dev-hot.ts";
+
+describe("dev hot generation", () => {
+  test("take returns the installed generation once", async () => {
+    let disposed = 0;
+    installDevHotGeneration({
+      async dispose() {
+        disposed += 1;
+      },
+    });
+    const first = takeDevHotGeneration();
+    expect(first).toBeDefined();
+    await first!.dispose();
+    expect(disposed).toBe(1);
+    expect(takeDevHotGeneration()).toBeUndefined();
+  });
+
+  test("install replaces the previous slot without disposing it", () => {
+    installDevHotGeneration({
+      async dispose() {
+        throw new Error("stale");
+      },
+    });
+    let disposed = 0;
+    installDevHotGeneration({
+      async dispose() {
+        disposed += 1;
+      },
+    });
+    const current = takeDevHotGeneration();
+    expect(current).toBeDefined();
+    return current!.dispose().then(() => {
+      expect(disposed).toBe(1);
+    });
+  });
+});

package/src/cli/dev-hot.ts

@@ -0,0 +1,48 @@
+/**
+ * One live `bun --hot` generation for `oke dev`.
+ *
+ * Soft reload re-runs the app runner in the same process. The previous
+ * boot's scheduler and Postgres pools stay open unless this slot disposes
+ * them before the next `boot()`.
+ */
+
+const DEV_HOT_SLOT = Symbol.for("oke.dev.hot.generation");
+
+/** Work the previous runner evaluation must undo before the next boot. */
+export type DevHotGeneration = {
+  /** Stop schedulers, drop signal handlers, and close this generation's pools. */
+  dispose(): Promise<void>;
+};
+
+type HotBox = { current?: DevHotGeneration };
+
+function hotBox(): HotBox {
+  const g = globalThis as typeof globalThis & { [DEV_HOT_SLOT]?: HotBox };
+  let box = g[DEV_HOT_SLOT];
+  if (!box) {
+    box = {};
+    g[DEV_HOT_SLOT] = box;
+  }
+  return box;
+}
+
+/**
+ * Take the previous generation, if a soft reload left one.
+ *
+ * Clears the slot so a failed dispose cannot be retried against a half-stopped app.
+ */
+export function takeDevHotGeneration(): DevHotGeneration | undefined {
+  const box = hotBox();
+  const prev = box.current;
+  box.current = undefined;
+  return prev;
+}
+
+/**
+ * Remember this evaluation so the next soft reload can dispose it.
+ *
+ * @param generation - Stop handle for the boot that just started
+ */
+export function installDevHotGeneration(generation: DevHotGeneration): void {
+  hotBox().current = generation;
+}

package/src/cli/dev.test.ts

@@ -1191,7 +1191,7 @@ describe("oke dev Console vault config", () => {
   test("writes OKE_MANIFEST_PATH for the app child when a Manifest is available", async () => {
     const runner = await Bun.file(new URL("./dev-app-runner.ts", import.meta.url)).text();
     expect(runner).toContain("OKE_MANIFEST_PATH");
-    expect(runner).toMatch(/mod\.app\.boot\(\{/);
+    expect(runner).toMatch(/\bapp\.boot\(\{/);
 
     const dir = await mkdtemp(join(tmpdir(), "oke-dev-manifest-handoff-"));
     await Bun.write(join(dir, "src/app.ts"), "export {}\n");

package/src/cli/dev.ts

@@ -1036,6 +1036,13 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     setProcessEnv("OKE_KV_DRIVER", stackKvDriver);
   }
 
+  // One secret for Console (this process) and the app child. Must land
+  // before the first import of the app entry.
+  {
+    const { ensureDevAuthSecret } = await import("./dev-auth-secret.ts");
+    setProcessEnv("OKE_AUTH_SECRET", await ensureDevAuthSecret(cwd));
+  }
+
   // One-shot schema sync for the compose (`dev`) profile: emits
   // drizzle/ for the active dialect, then pushes via drizzle-kit.
   let schemaPushOk = options.noDbPush === true;
@@ -1063,12 +1070,20 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
   // Vault gaps before seed / app — missing contracts (e.g. OPENROUTER_API_KEY).
   {
     const { maybeAskVaultGaps } = await import("./ask-vault-gaps.ts");
-    const vaultCode = await maybeAskVaultGaps({
-      cwd,
-      entry,
-      write,
-      stdinIsTTY: options.stdinIsTTY ?? process.stdin.isTTY,
-    });
+    // The secret prompt owns an open cursor line. A board repaint would
+    // move that cursor and split the mask.
+    bootBoard.hold();
+    let vaultCode = 0;
+    try {
+      vaultCode = await maybeAskVaultGaps({
+        cwd,
+        entry,
+        write,
+        stdinIsTTY: options.stdinIsTTY ?? process.stdin.isTTY,
+      });
+    } finally {
+      bootBoard.release();
+    }
     if (vaultCode !== 0) {
       bootBoard.stop();
       restoreProcessEnv();
@@ -1443,6 +1458,8 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
       autoPushRunner.trigger();
     }
   });
+  const { watchDecisionLockfile } = await import("./decision-lock-watch.ts");
+  const decisionLockWatch = watchDecisionLockfile(cwd);
 
   let stopped = false;
   const stop = () => {
@@ -1458,6 +1475,7 @@ export async function runDev(options: DevOptions = {}): Promise<DevResult> {
     clientRegen.cancel();
     manifestRefresh.cancel();
     watcher.close();
+    decisionLockWatch.close();
     const host = attachedHost;
     attachedHost = null;
     void host?.stop();

package/src/cli/eval.ts

@@ -4,6 +4,7 @@
 
 import { resolve } from "node:path";
 import { parseEvalJsonl, runPromptEvals, type EvalCase } from "../elements/ai/eval.ts";
+import type { DecisionResponse } from "../elements/ai/decisions/provider.ts";
 import type { Manifest } from "../manifest/types.ts";
 
 /** Options for {@link runOkeEval}. */
@@ -96,17 +97,157 @@ export async function runOkeEval(options: OkeEvalOptions = {}): Promise<number>
  */
 export async function evalCli(args: string[]): Promise<number> {
   let manifestPath: string | undefined;
+  let certify = false;
   for (let i = 0; i < args.length; i++) {
     const a = args[i]!;
     if (a === "--manifest" || a === "-m") {
       manifestPath = args[++i];
+    } else if (a === "--certify") {
+      certify = true;
     } else if (a === "--help" || a === "-h") {
-      console.log(`oke eval [--manifest oke.manifest.json]
+      console.log(`oke eval [--manifest oke.manifest.json] [--certify]
 
 Run prompt eval sets declared in the Manifest. Fails CI on regression.
+--certify builds a decision certificate from each decision seed file.
 `);
       return 0;
     }
   }
+  if (certify) return runOkeCertify({ manifestPath });
   return runOkeEval({ manifestPath });
 }
+
+/**
+ * Build certificates from decision seed files. Prompt evals are not run.
+ *
+ * @param options - Manifest path
+ */
+export async function runOkeCertify(
+  options: {
+    readonly manifestPath?: string;
+    readonly manifest?: Manifest;
+    readonly root?: string;
+    readonly evaluate?: (input: unknown) => Promise<DecisionResponse>;
+  } = {},
+): Promise<number> {
+  const { certifySeed } = await import("../elements/ai/decisions/certify.ts");
+  const { aiDecisionRegistry } = await import("../kernel/element-registries.ts");
+  const { DECISION_LOCK_FILENAME, parseDecisionLockfile } =
+    await import("../elements/ai/decisions/certificate.ts");
+  const { resolveStartEntry } = await import("./start.ts");
+  const root = resolve(options.root ?? process.env["OKE_ROOT_DIR"] ?? ".");
+  process.env["OKE_ROOT_DIR"] ??= root;
+  let manifest = options.manifest;
+  if (!manifest) {
+    try {
+      const entry = await resolveStartEntry(root);
+      await import(entry);
+    } catch (err) {
+      console.error(
+        `oke eval: failed to load the app: ${err instanceof Error ? err.message : String(err)}`,
+      );
+      return 1;
+    }
+    const path = resolve(root, options.manifestPath ?? "oke.manifest.json");
+    const file = Bun.file(path);
+    if (!(await file.exists())) {
+      console.error(`oke eval: manifest not found: ${path}`);
+      return 1;
+    }
+    manifest = (await file.json()) as Manifest;
+  }
+  const decisions = manifest.ai?.decisions ?? {};
+  const names = Object.keys(decisions);
+  if (names.length === 0) {
+    process.stdout.write("oke eval: no decisions declared\n");
+    return 0;
+  }
+  const injected = options.evaluate;
+  const lockPath = resolve(root, DECISION_LOCK_FILENAME);
+  const existingFile = Bun.file(lockPath);
+  const current = (await existingFile.exists())
+    ? parseDecisionLockfile(await existingFile.json())
+    : undefined;
+  const next = { decisions: { ...(current?.decisions ?? {}) } };
+  for (const name of names) {
+    const decision = decisions[name];
+    if (!decision?.evals) {
+      process.stdout.write(`oke eval: skip ${name} (no evals)\n`);
+      continue;
+    }
+    const decl = aiDecisionRegistry.find((item) => item.name === name);
+    if (!decl) {
+      console.error(`oke eval: decision "${name}" is not loaded`);
+      return 1;
+    }
+    const text = await Bun.file(resolve(root, decision.evals)).text();
+    const evaluate = injected ?? (await providerForDecision(decl));
+    next.decisions[name] = await certifySeed({
+      model: decl.model ?? decision.model ?? "",
+      maxError: decision.autonomy?.maxError ?? 0.05,
+      delta: decision.autonomy?.risk ?? decl.autonomy?.risk ?? 0.1,
+      jsonl: text,
+      ask: decl.ask,
+      evaluate,
+    });
+  }
+  await Bun.write(lockPath, `${JSON.stringify(next, null, 2)}\n`);
+  const { setDecisionDrift } = await import("../elements/ai/decisions/certificate.ts");
+  const { persistDecisionDrift } = await import("../elements/ai/decisions/labels.ts");
+  for (const name of names) {
+    setDecisionDrift(name, false);
+    persistDecisionDrift(name, false);
+  }
+  return 0;
+}
+
+async function providerForDecision(
+  decl: import("../elements/ai/declare.ts").AiDecisionDecl,
+): Promise<(input: unknown) => Promise<DecisionResponse>> {
+  const typesafe = decl.driverId === "typesafe";
+  const keyName = typesafe ? "TYPESAFE_API_KEY" : "OPENROUTER_API_KEY";
+  const apiKey = process.env[keyName];
+  if (!apiKey) throw new Error(`oke eval: secret "${keyName}" is not configured`);
+  const { createTypesafeDecisionProvider, TYPESAFE_JEV_MODEL } =
+    await import("../elements/ai/decisions/typesafe.ts");
+  const { createOpenRouterDecisionProvider, OPENROUTER_JEV_MODEL } =
+    await import("../elements/ai/decisions/openrouter.ts");
+  const provider = typesafe
+    ? createTypesafeDecisionProvider(apiKey)
+    : createOpenRouterDecisionProvider(apiKey);
+  const model = decl.model ?? (typesafe ? TYPESAFE_JEV_MODEL : OPENROUTER_JEV_MODEL);
+  return (input) =>
+    provider.evaluate({
+      model,
+      state: input,
+      questions: wireFromDecl(decl),
+    });
+}
+
+function wireFromDecl(
+  decl: import("../elements/ai/declare.ts").AiDecisionDecl,
+): import("../elements/ai/decisions/provider.ts").DecisionRequest["questions"] {
+  const questions: Record<string, import("../elements/ai/decisions/provider.ts").WireQuestion> = {};
+  for (const [id, question] of Object.entries(decl.ask)) {
+    if (question.kind === "choice") {
+      questions[id] = {
+        type: "choice",
+        instructions: question.instructions,
+        criteria: { ...question.options, none_of_these: null },
+      };
+    } else if (question.kind === "score") {
+      questions[id] = {
+        type: "score",
+        instructions: question.instructions,
+        criteria: question.levels,
+      };
+    } else {
+      questions[id] = {
+        type: "noul",
+        instructions: question.instructions,
+        ...(question.criteria !== undefined ? { criteria: question.criteria } : {}),
+      };
+    }
+  }
+  return questions;
+}

package/src/cli/index.ts

@@ -16,6 +16,7 @@ import { dbCli } from "./db.ts";
 import { devCli } from "./dev.ts";
 import { doctorCli } from "./doctor.ts";
 import { dockerCli } from "./docker.ts";
+import { decideCli } from "./decide.ts";
 import { evalCli } from "./eval.ts";
 import { EXIT_CODE_HELP, EXIT_OK, EXIT_USAGE } from "./exit.ts";
 import { gatesListCli } from "./gates-list.ts";
@@ -117,6 +118,10 @@ if (cmd === "eval") {
   process.exit(await evalCli(sub ? [sub, ...rest] : rest));
 }
 
+if (cmd === "decide") {
+  process.exit(await decideCli(sub ? [sub, ...rest] : rest));
+}
+
 if (cmd === "ai") {
   process.exit(await aiCli(sub ? [sub, ...rest] : rest));
 }

package/src/cli/load-config.images.test.ts

@@ -54,7 +54,7 @@ describe("defaultImagesFromConfig", () => {
     expect(images).toEqual({
       "store.sql": "postgres:18-alpine",
       pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.59",
-      "store.kv": "redis:8-alpine",
+      "store.kv": "docker.dragonflydb.io/dragonflydb/dragonfly:v2.0.0",
     });
   });
 
@@ -129,7 +129,7 @@ describe("resolveImages", () => {
       },
     });
     expect(images["store.sql"]).toBe("postgres:18-alpine");
-    expect(images["store.kv"]).toBe("redis:8-alpine");
+    expect(images["store.kv"]).toBe("docker.dragonflydb.io/dragonflydb/dragonfly:v2.0.0");
     expect(images["store.kv.durable"]).toBeUndefined();
   });
 });

package/src/cli/load-config.ts

@@ -16,7 +16,7 @@ import type { Manifest } from "../manifest/types.ts";
 const DEFAULT_SQL_IMAGE = "postgres:18-alpine";
 const DEFAULT_PGVECTOR_IMAGE = "pgvector/pgvector:pg17";
 const DEFAULT_PGDOG_IMAGE = "ghcr.io/pgdogdev/pgdog:v0.1.59";
-const DEFAULT_KV_IMAGE = "redis:8-alpine";
+const DEFAULT_KV_IMAGE = "docker.dragonflydb.io/dragonflydb/dragonfly:v2.0.0";
 
 /**
  * Prefer `dev` then `prod` for a driver map (compose infra ≈ production).

package/src/cli/mcp-from-console.ts

@@ -22,6 +22,10 @@ export interface McpConsoleSurface {
   readonly cwd: string;
   /** Clock shared with Console. */
   readonly now: () => number;
+  /** Journal that holds agent events and parked approvals. */
+  readonly journalStore?: import("../kernel/journal.ts").JournalStore | null;
+  /** In-process agent ledger. The follow log is the durable source. */
+  readonly aiRuntime?: import("../elements/ai.ts").AiRuntime | null;
 }
 
 /**
@@ -33,6 +37,50 @@ export function mcpContextFromConsole(state: McpConsoleSurface): McpContext {
   return {
     getManifest: () => state.manifest,
     listRuns: () => state.listRuns(),
+    listAgentRuns: async () => {
+      const { loadConsoleAgentRuns } = await import("../console/server/ai-runs.ts");
+      return loadConsoleAgentRuns({
+        runtime: state.aiRuntime ?? null,
+        store: state.journalStore ?? null,
+        now: state.now(),
+      });
+    },
+    getAgentRun: async (runId) => {
+      const { loadConsoleAgentRun } = await import("../console/server/ai-runs.ts");
+      const run = await loadConsoleAgentRun(
+        {
+          runtime: state.aiRuntime ?? null,
+          store: state.journalStore ?? null,
+          now: state.now(),
+        },
+        runId,
+      );
+      if (!run) return undefined;
+      return { run, events: run.events };
+    },
+    listApprovals: async () => {
+      const { loadApprovalQueue } = await import("../console/server/ai-runs.ts");
+      return loadApprovalQueue(state.journalStore ?? null, state.now());
+    },
+    listDecisions: async (tenant) => {
+      const { loadDecisionQueue, projectMcpDecisions, candidateMetrics } =
+        await import("../console/server/decisions.ts");
+      const { listDecisionCandidates, loadDecisionCandidate } =
+        await import("../elements/ai/decisions/labels.ts");
+      const names = await listDecisionCandidates();
+      const fitted: Record<string, Record<string, number>> = {};
+      for (const name of names) {
+        const metrics = candidateMetrics(await loadDecisionCandidate(name));
+        if (metrics) fitted[name] = metrics;
+      }
+      const queue = await loadDecisionQueue(state.journalStore ?? null, state.now(), tenant);
+      const pending: Record<string, number> = {};
+      for (const row of queue) {
+        if (row.status !== "pending" || row.labelOnly) continue;
+        pending[row.decision] = (pending[row.decision] ?? 0) + 1;
+      }
+      return projectMcpDecisions(state.manifest, pending, fitted);
+    },
     proposeStructural: async (input) =>
       emitStructuralDiff({
         cwd: state.cwd,

package/src/cli/registry.ts

@@ -550,7 +550,41 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
     name: "eval",
     summary: "prompt eval sets (CI gate)",
     leaf: true,
-    flags: [MANIFEST, HELP],
+    flags: [
+      MANIFEST,
+      {
+        long: "--certify",
+        takesValue: false,
+        summary: "Build a decision certificate from the seed file",
+      },
+      HELP,
+    ],
+  },
+  {
+    name: "decide",
+    summary: "promote a decision certificate",
+    subcommands: [
+      {
+        name: "promote",
+        summary: "Fetch the operator candidate and write the app lockfile",
+        positionals: "<name>",
+        flags: [
+          {
+            long: "--origin",
+            takesValue: true,
+            valueName: "url",
+            summary: "App origin that serves the candidate",
+          },
+          {
+            long: "--lock",
+            takesValue: true,
+            valueName: "path",
+            summary: "Lockfile path (default oke-decisions.lock.json)",
+          },
+          HELP,
+        ],
+      },
+    ],
   },
   {
     name: "ai",